PaperlayerView exact revision on arXiv

Source-linked AI summary

Context-dependent Runtime Construction of Safe Regions of Attraction from Design-Time Identification for Multi-Candidate Simplex Architectures

Georg Jäger, Nils-Jonathan Friedrich, Norman Seyffer, José Cecílio, António Casimiro

arXiv:2610.35040v1cs.ROcs.SYeess.SY

TL;DR

Safety-critical systems need adaptable performance alongside formal safety guarantees, but existing Runtime Assurance approaches face conservatism or runtime costs. This paper combines design-time RoA certification with context-dependent construction and multi-candidate Simplex switching. In robotic path tracking, simulations confirmed safety, physical deployment required prediction-horizon adjustment for unmodeled dynamics, and the decision module had low average latency.

  • Problem

    Runtime Assurance faces a trade-off between context-aware runtime reachability’s computational overhead and low-overhead design-time global RoA approximations’ conservatism.

    Source: §I · p. 1, §V · p. 11

  • Method

    The method combines contraction analysis and Taylor-model reachability to form controller recovery profiles, then uses them for context-dependent RoA construction and multi-candidate Simplex switching.

    Source: §I · p. 1, B. Runtime Construction of… · p. 4, §V · p. 11

  • Results

    0.0281 ms average latency was reported for the decision module, while simulations confirmed safety and physical deployment required prediction-horizon adjustment for unmodeled dynamics.

    Source: C. ODE-based Simulation · p. 9, §V · p. 11

  • Takeaways & Limitations

    The architecture uses complementary HA-candidate RoA coverage to enlarge the safe operating envelope while supporting low-overhead, context-dependent runtime construction.

    Source: §V · p. 11

    Physical deployment revealed that unmodeled dynamics require adjusting the prediction horizon to introduce safety margins.

    Source: §V · p. 11

Abstract

from arXiv · show

Deploying safety-critical cyber-physical systems requires control strategies that reconcile high performance and adaptability with rigorous safety guarantees. Classical control strategies offer stability proofs but are conservative, while advanced optimization- and learning-based controllers achieve high performance but lack formal verification. Runtime Assurance (RTA) architectures bridge this gap by introducing their own (dis-)advantages. Safety filters use online optimization and introduce chattering, while Simplex permissiveness is bounded by the tightness of the certified Region of Attraction (RoA) of its High-Assurance (HA) controller. Targeting this conservatism, we present a two-stage RoA certification procedure leveraging contraction-based stability to establish a target set for Taylor-model-based reachability analysis. We then treat the closed-loop system under HA control as a switched system, enabling: (a) runtime construction of context-dependent safe RoA and (b) safe switching between HA candidates to optimize recovery and maximize the operating envelope of the uncertified High-Performance (HP) controller. We validate this framework on a robotic path-tracking task using a three-stage evaluation: Ordinary Differential Equation (ODE) simulation for theoretical verification, high-fidelity Gazebo simulation under unmodeled dynamics, and experiments on physical hardware. Results show that the Simplex architecture maintains safety under fault injection and successfully shields a behavioral-cloning-trained HP controller. Crucially, the decision module introduces negligible overhead (0.028 ms average, 4.13 ms worst-case), consuming under 10 % of the control period.

I. INTRODUCTION

The introduction frames the challenge of combining safety guarantees with adaptable performance, then motivates a Simplex approach that improves on conservative safe-RoA estimates through design-time identification and runtime use of multiple HA candidates. Its review contrasts Simplex with safety filters, blending, and reachability-based RTA, each of which has distinct practical limitations.

I. INTRODUCTION

  • The paper combines contraction-based analysis and Taylor-model reachability to certify controller RoAs, then uses recovery profiles for context-dependent runtime construction and switching among HA candidates.Candidate switching can optimize recovery while exploiting complementary RoA coverage.Source: §I · pp. 1–2

A. Safety Filters based on Control Barrier Functions

  • Safety filters can guarantee forward invariance, but online optimization for non-control-affine systems complicates deterministic execution-time bounds and can cause chattering and actuator wear.Near safe-set boundaries, small state fluctuations can repeatedly toggle constraints.Source: A. Safety Filters based on Control… · p. 2

B. Blending Architectures

  • Blending provides more continuous actuator commands, but proving safety and stability is demanding, and full-state correctness may engage HA control earlier than necessary.Convex combinations can also produce unintended equilibria or cancel conflicting control efforts.Source: B. Blending Architectures · p. 2

C. Reachability-Based Runtime Assurance

  • Reachability-based RTA can reduce conservatism through context-specific per-trajectory proofs, but nonlinear set propagation incurs wrapping and high online computational cost.On embedded platforms, deterministic worst-case completion within a sampling period is a major challenge.Source: C. Reachability-Based Runtime Assurance · pp. 2–3

D. Simplex Architecture and Switching Logic

The section positions Simplex as a low-overhead alternative whose switching performance depends on how the HA controller’s recoverable region is characterized. It reviews RoA estimation methods, including Lyapunov analysis and mode-specific stability reasoning for switched systems.

D. Simplex Architecture and Switching Logic

  • Simplex uses an HP controller, an HA controller, and a decision module to switch when HP actions are unsafe and return after recovery; its success depends on safe, performant switching logic.RoA characterization creates a trade-off between online reachability’s computational cost and static approximations’ conservatism.Source: D. Simplex Architecture and Switching… · p. 3

E. Estimating Regions of Attraction

  • A Region of Attraction is the set of initial states from which the closed-loop system is guaranteed to stabilize; design-time analysis can reduce runtime computation for switching rules.The section compares Lyapunov stability, contraction analysis, and reachability as methods with increasing computational effort for reducing conservatism.Source: E. Estimating Regions of Attraction · p. 3

1) Lyapunov Analysis:

  • Lyapunov analysis uses a decreasing positive-definite function to establish stability, with its sublevel set serving as a forward-invariant RoA estimate.A common Lyapunov function across parameter variations can underestimate parameter-dependent RoAs; switched systems can instead use mode-specific functions and dwell-time conditions.Source: 1) Lyapunov Analysis · pp. 3–4

2) Contraction Analysis:

Contraction analysis extends Lyapunov stability to convergence between neighboring trajectories and can certify stability across state and parameter intervals. The paper combines this analysis with reachability and a multi-candidate Simplex design for path tracking.

2) Contraction Analysis:

  • Contraction analysis checks whether infinitesimally neighboring trajectories converge, using a coordinate-transformed displacement δz = Θδx with ΘT Θ = P.The transformed dynamics use the system Jacobian J(x), and the squared distance is δxT Pδx.Source: 2) Contraction Analysis · p. 4
  • Uniform negative definiteness of the symmetric transformed Jacobian guarantees contraction and a forward-invariant quadratic sublevel set, but the resulting stability-region estimate is symmetric and convex.These estimates may not capture non-convex, potentially asymmetric RoA boundaries.Source: 2) Contraction Analysis · p. 4

3) Reachability Analysis:

  • Reachability analysis can produce accurate, non-convex RoA estimates and reduce conservatism, with design-time use avoiding online computational overhead.The reviewed approaches include forward reachable sets, precomputed contractive terminal sets, and explicit or implicit reachability formulations.Source: 3) Reachability Analysis · p. 4

III. MULTI-CANDIDATE SIMPLEX ARCHITECTURE

  • The proposed multi-candidate Simplex constructs context-dependent safe RoAs at runtime from design-time RoA results, while the illustrative use case tracks a reference path with a differential-drive robot.The system definition uses a continuous reference path and Frenet-frame error dynamics; the theoretical development assumes a safely stabilizing HA controller.Source: §III · p. 4, A. System Definition · p. 4

B. Runtime Construction of Context-Dependent RoAs from Designtime Identification Results

The safe RoA identification separates design-time certification from runtime construction to limit overhead while reducing conservatism. The resulting safe RoA concerns initial states whose trajectories remain safe and converge to a target set under parameter variation.

B. Runtime Construction of Context-Dependent RoAs from Designtime Identification Results

  • The pipeline identifies safe RoAs at design time, then dynamically constructs a context-dependent safe RoA at runtime for the HA controller.The closed-loop dynamics include parameters representing uncertain or variable operating conditions.Source: B. Runtime Construction of… · p. 4
  • The parameter space is partitioned to represent different operating contexts for constructing the safe RoA.In the path-tracking example, the active parameter is reference-path curvature.Source: B. Runtime Construction of… · p. 4
  • A safe RoA comprises initial states whose trajectories remain within the safety set and asymptotically converge to a target set under parameter variations.The target set is the contraction ellipsoid E.Source: B. Runtime Construction of… · p. 5

1) Stage 1 – Contraction ellipsoid:

The two-stage certification first establishes a contraction ellipsoid, then uses per-bin reachability to extend the certified safe RoA. In the path-tracking example, the reach-tube enters the ellipsoid while satisfying the lateral-error safety bound.

1) Stage 1 – Contraction ellipsoid:

  • Stage 1 searches for a contraction metric and verifies the largest invariant ellipsoid E across the parameter envelope.Candidate metrics come from Lyapunov equations at sampled parameter points; parameter partitioning and state-box bisection help manage interval over-approximation.Source: 1) Stage 1 – Contraction ellipsoid · p. 5

2) Stage 2 – Per-bin reachability bisection:

  • The contraction ellipsoid is a conservative inner region of the overall RoA, motivating the second-stage reachability analysis.The reach-tube bounds may initially diverge because of interval representation before contracting into E.Source: 1) Stage 1 – Contraction ellipsoid · p. 5, 2) Stage 2 – Per-bin reachability… · p. 6
  • Stage 2 treats parameter bins as switched-system modes and computes safe RoAs for each bin using Taylor-model forward reachability.A cell is retained when its reach-tube remains in the safety set and eventually enters E; otherwise, the state space is bisected up to a maximum depth.Source: 2) Stage 2 – Per-bin reachability… · p. 6
  • The reach-tube enters the contraction ellipsoid while maintaining |ey| ≤1 m, and the opposite-curvature-bin RoAs overlap substantially but differ in coverage.Wider curvature bins make the approximation more conservative and reduce differences in coverage.Source: 2) Stage 2 – Per-bin reachability… · p. 6

3) Runtime Construction of Context-Dependent RoAs:

The runtime method constructs a safe RoA from the bins touched by the active parameter context, rather than requiring safety over the full design-time parameter space. The decision module uses multiple HA candidates to cover different state and parameter regions.

3) Runtime Construction of Context-Dependent RoAs:

  • The context-dependent RoA requires the active parameter subset to remain valid over the maximum dwell time and is bounded by the design-time parameter space.Its computation uses set intersection, which limits runtime overhead.Source: 3) Runtime Construction of… · p. 6
  • Intersecting the safe RoAs of active parameter bins guarantees recovery to E under parameter transitions within the maximum dwell time.Each bin contributes a trajectory-based proof.Source: 3) Runtime Construction of… · p. 6
  • Restricting the intersection to active bins yields a context-dependent RoA that is a superset of the global intersection.This can enlarge the certified operating region relative to using all design-time bins.Source: 3) Runtime Construction of… · p. 6

C. Decision Module

  • Multiple HA candidates can cover distinct regions, allowing the decision module to accept an HP action if any candidate certifies it and to switch HA candidates to optimize recovery.The architecture also hands control back to HP after recovery is complete.Source: C. Decision Module · p. 6

1) HP to HA Switch:

The HP-to-HA check tests a predicted state against each candidate’s context-dependent safe RoA. Candidates are ordered by maximum dwell time so the selected certifying controller offers the fastest recovery.

1) HP to HA Switch:

  • Candidates are evaluated in ascending maximum dwell time, favoring the certifying HA controller with the fastest recovery.Other performance criteria could be optimized instead.Source: 1) HP to HA Switch · p. 6
  • A candidate is admissible when the predicted state lies within its runtime safe RoA, constructed from parameter bins active over that candidate’s recovery horizon.The check uses the candidate’s recovery profile and the active parameter subset.Source: 1) HP to HA Switch · pp. 6–7
  • If no candidate certifies the proposed HP action, the decision module switches to HA using the last returned candidate index.A transition to that candidate is safe because it can recover from the predicted state.Source: 1) HP to HA Switch · p. 7

2) HA to HA Switch:

During HA recovery, the decision module can switch to another candidate only after certifying the predicted state under that candidate. Once the state enters the active controller’s contraction ellipsoid, control can return to HP.

2) HA to HA Switch:

  • HA-to-HA switching predicts the next state under the active HA controller and permits a transition only when another candidate certifies that state.The active parameter space is reevaluated over the lookahead horizon, and finite sorted candidates limit switches per recovery phase, preventing chattering.Source: 2) HA to HA Switch · p. 7
  • For path tracking, HA-to-HA transitions are restricted to states where the robot is heading toward the path.This prioritizes limiting maximum path deviation alongside recovery time.Source: 2) HA to HA Switch · p. 7

3) HA to HP Switch:

  • Control returns to HP when the state enters the active candidate’s contraction ellipsoid; the common Lyapunov function then guarantees stability under arbitrary switching without dwell times.For path tracking, the safe RoA is symmetric around the nominal equilibrium; generic nonsymmetric RoAs may require hysteresis to prevent chattering.Source: 3) HA to HP Switch · p. 7

4) Complete Simplex Controller:

The complete Simplex controller checks HP actions against HA candidates, invokes HA recovery when none certifies an action, and returns to HP after recovery. The evaluation spans simulation and hardware, using a differential-drive robot and two RPP configurations as HA controllers.

4) Complete Simplex Controller:

  • If no HA candidate certifies the proposed HP action, the controller enters HA mode; during recovery it checks for return to HP and may switch HA candidates.If a candidate certifies the action, the HP action is applied and that candidate becomes active for potential recovery.Source: 4) Complete Simplex Controller · p. 7

IV. EVALUATION

  • The evaluation uses ODE simulation, Gazebo simulation with unmodeled dynamics, and physical experiments to examine safety, prediction horizon, and runtime overhead.The physical experiments also assess shielding of a behavioral-cloning HP controller.Source: §IV · p. 8

A. Description of the Mobile Robot

  • The differential-drive robot is evaluated against a 1 m lateral safety margin, with linear speed capped at 1.5 m/sec and angular speed at 6.5 rad/sec.The margin is scenario-specific; other safety requirements can be adopted without changing the methodology.Source: A. Description of the Mobile Robot · p. 8

B. Searching for HA controllers

  • The evaluation identifies and certifies two RPP configurations as HA controllers using the two-stage recovery-profile procedure.The RPP configurations are selected after runtime context identification by curvature approximation.Source: B. Searching for HA controllers · p. 8, §IV · p. 8

1) High-Assurance Controller Design:

  • The RPP controller regulates lookahead distance using curvature-dependent steady-state velocity, removing a circular dependency that would amplify interval-propagation wrapping.The selected geometric control law is used to mitigate wrapping effects in recovery-profile interval propagation.Source: 1) High-Assurance Controller Design · p. 8

2) Curvature Estimation:

The section estimates path curvature to construct context-dependent safe RoAs, searches HA configurations for complementary coverage, and evaluates their switching in ODE simulations. The simulations report safe recovery under matched dynamics and show how multi-candidate switching combines the candidates’ recovery strengths.

2) Curvature Estimation:

  • Curvature is estimated by fitting a circle to a sliding waypoint window; its magnitude is the inverse radius and its sign comes from successive chord vectors.A window of 30 filters noise but can miss sharp local curvature; a window of 5 tracks transitions more accurately but is noise-sensitive.Source: 2) Curvature Estimation · p. 8

3) Configuration Search:

  • The search constructs 24 HA configurations spanning vdes ∈{1, 1.5} m/sec, Lmin ∈{0.35, 0.7} m, th ∈{0.35, 0.7, 1.0} sec, and Rmin ∈{0.3, 0.7} m, then selects the configuration yielding highest coverage and desired velocity.At vdes = 1.50 m/sec, γ15 reached the highest number of safe cells.Source: 3) Configuration Search · pp. 8–9

C. ODE-based Simulation

  • The ODE campaigns inject faults by inverting HP angular velocity from t = 2.0 sec to 5.0 sec and compare single-candidate and multi-candidate switching setups.The campaigns also test multi-candidate switching with the heading-alignment check disabled.Source: C. ODE-based Simulation · p. 9
  • All |ey|max ≤1.0 m, confirming that one-step prediction suffices to guarantee safety when model dynamics are matched.The ODE evaluation uses four Monte-Carlo campaigns with N = 1000 runs each.Source: C. ODE-based Simulation · p. 9
  • Multi-candidate switching combines γ4’s wider RoA with γ15’s faster recovery, allowing a mean |ey|switch of 0.439 m and a maximum of 0.706 m while achieving fast recovery.Disabling the heading-alignment check slightly speeds mean recovery but raises peak deviation to 0.977 m, compared with Experiment 3.Source: C. ODE-based Simulation · p. 9

D. Gazebo

Gazebo tests show that longer prediction horizons are needed to maintain lateral safety under unmodeled dynamics, while the real-world circular trials require h = 15 for safety across all configurations. The physical experiments also report low decision-module latency.

D. Gazebo

  • In Gazebo, prediction horizons h ≥10 maintain lateral safety, whereas horizons up to h = 5 produce violations for both γ15 and γ4 under dynamics not captured by the RoA model.A horizon of h = 15 triggers conservative HA switches that reduce peak deviations.Source: D. Gazebo · p. 10
  • Gazebo’s hysteresis ratio α has no systematic tracking effect: at h = 10, mean deviation varies by at most 0.07 m for γ15 and 0.02 m for γ4 across α values.The authors attribute the limited impact to symmetric RoAs that cover the contraction ellipsoid well.Source: D. Gazebo · p. 10
  • With γ4 + γ15 switching on the outer cosine path at h = 10, maximum deviation remains bounded at 0.894 m across 10 runs; γ4’s mean recovery is 0.906 s versus γ15’s 5.934 s.The switching logic starts with γ4’s wider RoA, then transitions to γ15 once admissible.Source: D. Gazebo · p. 10

1) Circular Scenarios:

  • As in Gazebo, increasing prediction horizon reduces maximum deviation: h = 1 violates safety for all configurations, while h = 15 keeps the maximum below 0.69 m across all configurations and curvatures.At h = 10, γ4 + γ15 violates safety at κref ∈{0.2, 0.9}; only h = 15 maintains safety in all configurations.Source: 1) Circular Scenarios · pp. 10–11
  • In the real-world circular trials, safety violations at h = 10 for γ4 + γ15 occur when switching directly to γ15 during an active HA phase.A brief HA activation near 70 sec is reported as a single-period false positive caused by a curvature discontinuity from ROS2 path replanning.Source: 1) Circular Scenarios · p. 10
  • Across 81 749 real-world decision cycles, average latency is 0.0281 ms and worst-case latency is 4.1303 ms, under 0.1% and 10% of the 50 ms control period, respectively.The authors note that worst-case latencies require deeper analysis.Source: 1) Circular Scenarios · p. 11

2) Real-World Scenario:

The real-world Simplex run kept lateral deviation below the safety threshold while requiring brief HA intervention. The conclusion reports evaluation across simulation and hardware, low average runtime overhead, and open questions about timing analysis and broader applicability.

2) Real-World Scenario:

  • A behavioral-cloning neural-network HP controller was tested on an urban track with h = 12 because h = 10 could violate safety constraints.The controller was trained for 50 epochs on offline expert data collected by manually controlling the prototype.Source: 2) Real-World Scenario · p. 11
  • Maximum lateral deviation stayed below the 1.0 m threshold, with NHA = 3 and max(THA) = 1.050 s across three real-world runs.HA controllers acted only at the final critical curve; start- and end-position activations from discontinuities were excluded from the analysis.Source: 2) Real-World Scenario · p. 11, Figure 8 · p. 11

V. CONCLUSIONS

  • The recovery profile supports context-dependent runtime RoA construction and HA-to-HA switching, using complementary candidate coverage to enlarge the safe operating envelope.The approach combines contraction analysis with Taylor-model reachability and uses parameter-space partitioning and binning to curb wrapping effects.Source: §V · p. 11
  • 0.0281 ms average latency was under 0.1% of the 50 ms control period, while worst-case latency reached 4.13 ms.The authors call for further investigation of the average-to-worst-case discrepancy.Source: §V · p. 11
  • The framework was evaluated on robotic path tracking in ODE simulation, Gazebo, and a physical differential-drive robot.Physical deployment showed that unmodeled dynamics required prediction-horizon adjustment to introduce safety margins.Source: §V · p. 11
  • Future work includes formal timing and schedulability analysis, richer physical error dynamics in offline verification, and evaluation on other system classes and higher-dimensional states.The authors also identify evaluating Lyapunov-based hysteresis for HA-to-HP transitions as a future direction.Source: §V · p. 11
Loading 2610.35040v1…